An administrator is configuring their transparent Cisco FTD device to receive ERSPAN traffic from multiple switches on a passive port, but the Cisco FTD is not processing the traffic. What is the…

While Layer 3 connectivity is needed, the fundamental problem is that a transparent FTD operates at Layer 2 and cannot provide the necessary Layer 3 processing for GRE traffic.

An ERSPAN monitor session ID mismatch would be a configuration error if the FTD were able to process ERSPAN, but the primary issue is the FTD's operational mode.

ERSPAN (Encapsulated Remote SPAN) traffic is encapsulated within a GRE header, which operates at Layer 3 and requires IP routing to reach its destination. A transparent mode Cisco FTD device functions as a Layer 2 bridge and cannot process or route Layer 3 encapsulated traffic like ERSPAN, thus it must be in routed mode to function as an ERSPAN termination point.

There is no specific 'ERSPAN port' type; ERSPAN traffic is received on a standard physical or sub-interface configured for Layer 3 routing, which is not possible in transparent mode.